WordPress bLoyal: Loyalty & Promotions by bLoyal plugin <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings vulnerability

Authenticated Subscriber+ Privilege Escalation via Unprotected AJAX API URL Settings vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin bLoyal versions = 3.1.611.78...

WordPress RapiSafe plugin <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters vulnerability

Unauthenticated Arbitrary File Deletion via 'rsmfcf7session' and 'filename' Parameters vulnerability discovered by Spy0x7 in WordPress Plugin RapiSafe – Secure Multi File Upload for Contact Form 7 versions = 1.0.4...

CVE-2026-13700

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the...

EUVD-2026-60057

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the...

CVE-2026-13700 WooMS <= 9.14 - Unauthenticated Server-Side Request Forgery and Sensitive Information Disclosure

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the...

CVE-2026-13700

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the...

PT-2026-77040

Name of the Vulnerable Software and Affected Versions Cwicly versions prior to 1.4.5 Description A flaw allows a contributor to achieve Remote Code Execution RCE, which is the ability to execute arbitrary commands on a remote machine over a network. Recommendations Update to a version newer than...

PT-2026-78275

Name of the Vulnerable Software and Affected Versions Eventin WordPress plugin versions prior to 4.1.21 Description Insufficient ownership verification allows users with contributor-level access and above to modify or delete schedule records created by other users. Recommendations Update Eventin...

PT-2026-77045

Name of the Vulnerable Software and Affected Versions Grab WeChat Articles versions prior to 2.0.2 Description A Server Side Request Forgery SSRF issue exists in the software, which could allow an attacker to induce the server-side application to make requests to an unintended location...

PT-2026-78301

Name of the Vulnerable Software and Affected Versions ProSolution WP Client versions prior to 2.0.11 Description Insufficient sanitization and escaping of the page parameter on an administrative page allows for reflected Cross-Site Scripting XSS. This occurs when an administrator is induced to...

PT-2026-78284

Name of the Vulnerable Software and Affected Versions NextScripts: Social Networks Auto-Poster WordPress plugin versions prior to 4.4.8 Description Reflected Cross-Site Scripting XSS occurs when an application includes untrusted data in a web page without proper validation or escaping. The plugin...

PT-2026-73209

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the...

PT-2026-78279

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master QSM WordPress plugin versions prior to 11.2.4 Description Insufficient per-object ownership verification occurs when saving front-end text settings for a quiz. This allows users with contributor-level access or higher to...

PT-2026-76767

Name of the Vulnerable Software and Affected Versions Forminator versions prior to the patch released in response to this disclosure Description An unauthenticated arbitrary file upload flaw allows an attacker to upload malicious PHP files to the server, leading to Remote Code Execution RCE, whic...

PT-2026-77041

Name of the Vulnerable Software and Affected Versions Sync Post With Other Site versions prior to 1.9.4 Description The Sync Post With Other Site plugin for WordPress allows authenticated attackers with contributor-level access and above to upload arbitrary files to the server. This issue occurs...

PT-2026-78271

Name of the Vulnerable Software and Affected Versions Dinatur WordPress plugin versions prior to 1.19 Description Unauthenticated users can perform SQL injection attacks because user input is not sanitized or escaped before being used in a SQL query. Additionally, a handler allows unauthenticated...

PT-2026-78281

Name of the Vulnerable Software and Affected Versions User Verification by PickPlugins WordPress plugin versions prior to 2.0.48 Description The plugin fails to verify if a request to resend a verification email is authorized for the specified user and does not bind the protection token to that...

CVE-2024-13784 Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2026-2497

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 'galleryorderpostid' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-18347

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...